@orboto/mcp 0.178.0

package/dist/tools/identity.js

@@ -0,0 +1,60 @@
+/**
+ * ORB-799 - identity / debug tools.
+ *
+ * `orboto_whoami` - return the authenticated principal as `{id, email,
+ * fullName, isBot}`. Mirrors `orboto.mjs whoami`. The wrapper hits the
+ * existing `/users/me` route directly; we do the same so a stale-token
+ * 401 surfaces the same way it does for every other tool.
+ *
+ * Useful for debugging "which API key is this session actually using?",
+ * which is the most common confusion when an agent has multiple MCP
+ * configs (`claude-desktop`, `cursor`, `gemini-cli`) wired to different
+ * `orb_*` keys.
+ */
+import { z } from 'zod';
+export const whoamiToolConfig = {
+    title: 'Show the authenticated MCP principal',
+    description: 'Return the authenticated user record `{id, email, fullName, isBot, workspaceLocale}` corresponding to the API key this MCP server is running with. Useful for debugging which credential / bot identity is in use when multiple MCP configs are wired to different `orb_*` keys. **`workspaceLocale` (ORB-989)** is the language the workspace expects tickets / comments / docs in - check it before a mass-create so you write in the right language from the start instead of relying on the after-the-fact language-mismatch warning.',
+    inputSchema: z.object({}).shape,
+    outputSchema: z.object({
+        id: z.string(),
+        email: z.string(),
+        fullName: z.string().nullable(),
+        isBot: z.boolean(),
+        workspaceLocale: z.string().nullable(),
+        // ORB-1671 - both identities of a delegated act-as connection.
+        actingAuthorizedBy: z.object({ id: z.string(), email: z.string(), fullName: z.string() }).nullable(),
+    }).shape,
+    annotations: { readOnlyHint: true, idempotentHint: true },
+};
+export function makeWhoamiHandler(client) {
+    return async () => {
+        const me = await client.get('/users/me');
+        const isBot = me.isBot === true;
+        const workspaceLocale = me.workspaceLocale ?? null;
+        const lines = [
+            `${me.fullName ?? '(no name)'} <${me.email}>`,
+            `  id: ${me.id}`,
+            `  bot: ${isBot ? 'yes' : 'no'}`,
+        ];
+        if (workspaceLocale) {
+            lines.push(`  workspace language: ${workspaceLocale} (write tickets in this language)`);
+        }
+        // ORB-1671 - an act-as connection reports BOTH identities so the agent
+        // (and a human debugging it) can see who it acts as and who authorised it.
+        if (me.actingAuthorizedBy) {
+            lines.push(`  acting as this bot, authorised by: ${me.actingAuthorizedBy.fullName} <${me.actingAuthorizedBy.email}>`);
+        }
+        return {
+            content: [{ type: 'text', text: lines.join('\n') }],
+            structuredContent: {
+                id: me.id,
+                email: me.email,
+                fullName: me.fullName ?? null,
+                isBot,
+                workspaceLocale,
+                actingAuthorizedBy: me.actingAuthorizedBy ?? null,
+            },
+        };
+    };
+}

package/dist/tools/identity.test.js

@@ -0,0 +1,67 @@
+/**
+ * ORB-799 - `orboto_whoami` unit tests.
+ */
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
+import { OrbotoApiError, OrbotoClient } from '../orboto-client.js';
+import { makeWhoamiHandler } from './identity.js';
+beforeEach(() => { vi.restoreAllMocks(); });
+afterEach(() => { vi.restoreAllMocks(); });
+function stub(responses) {
+    const calls = [];
+    vi.spyOn(globalThis, 'fetch').mockImplementation(async (url, init) => {
+        calls.push({ url: url.toString(), method: init?.method ?? 'GET' });
+        const r = responses.shift();
+        if (!r)
+            throw new Error(`unexpected extra fetch`);
+        return {
+            ok: r.ok ?? true,
+            status: r.status ?? 200,
+            statusText: 'OK',
+            json: async () => ('json' in r ? r.json : {}),
+            text: async () => '',
+        };
+    });
+    return calls;
+}
+const client = new OrbotoClient({ baseUrl: 'https://orboto.example.com', apiKey: 'orb_x' });
+describe('orboto_whoami', () => {
+    it('returns the authenticated user shape from /users/me', async () => {
+        const calls = stub([
+            { json: { id: 'u1', email: 'agent-e@orboto.io', fullName: 'Claude Agent E', isBot: true, workspaceLocale: 'en' } },
+        ]);
+        const res = await makeWhoamiHandler(client)();
+        expect(calls[0].url).toBe('https://orboto.example.com/users/me');
+        expect(calls[0].method).toBe('GET');
+        expect(res.structuredContent).toEqual({
+            id: 'u1',
+            email: 'agent-e@orboto.io',
+            fullName: 'Claude Agent E',
+            isBot: true,
+            workspaceLocale: 'en',
+            actingAuthorizedBy: null,
+        });
+        expect(res.content[0].text).toContain('agent-e@orboto.io');
+    });
+    it('surfaces workspaceLocale in the text output when present (ORB-989)', async () => {
+        stub([{ json: { id: 'u4', email: 'agent@orboto.io', fullName: 'Agent', isBot: true, workspaceLocale: 'de' } }]);
+        const res = await makeWhoamiHandler(client)();
+        expect(res.content[0].text).toContain('workspace language: de');
+        expect(res.structuredContent).toMatchObject({ workspaceLocale: 'de' });
+    });
+    it('handles missing fullName + missing isBot flag (treats as not-a-bot)', async () => {
+        stub([{ json: { id: 'u2', email: 'human@orboto.io' } }]);
+        const res = await makeWhoamiHandler(client)();
+        expect(res.structuredContent).toMatchObject({
+            id: 'u2',
+            email: 'human@orboto.io',
+            fullName: null,
+            isBot: false,
+            workspaceLocale: null,
+            actingAuthorizedBy: null,
+        });
+    });
+    it('surfaces a 401 from the API as OrbotoApiError', async () => {
+        stub([{ ok: false, status: 401, json: { error: 'invalid token' } }]);
+        await expect(makeWhoamiHandler(client)()).rejects.toBeInstanceOf(OrbotoApiError);
+    });
+});

package/dist/tools/list-git-app-installations.js

@@ -0,0 +1,45 @@
+/**
+ * ORB-320 - `orboto_list_git_app_installations`.
+ *
+ * Returns every GitHub App installation orboto knows about. Wraps
+ * `GET /admin/git-app-installations` (super-admin only on the API
+ * side; a 403 here means the caller's API key isn't super-admin).
+ *
+ * Useful for agents triaging "is my repo connected?" questions
+ * without paging through Project Settings → Git in every project.
+ */
+import { z } from 'zod';
+export const listGitAppInstallationsToolConfig = {
+    title: 'List GitHub App installations',
+    description: 'Return every GitHub App installation orboto knows about (across all projects). Requires super-admin on the API side. Each row carries the org/user the App is installed on, when it was installed, and whether it is currently suspended.',
+    inputSchema: z.object({}).shape,
+    outputSchema: z.object({
+        installations: z.array(z.object({
+            provider: z.string(),
+            accountLogin: z.string(),
+            accountType: z.string(),
+            installedAt: z.string(),
+            suspended: z.boolean(),
+        })),
+    }).shape,
+    annotations: { readOnlyHint: true, idempotentHint: true },
+};
+export function makeListGitAppInstallationsHandler(client) {
+    return async () => {
+        const rows = await client.get('/admin/git-app-installations');
+        const out = rows.map((r) => ({
+            provider: r.provider,
+            accountLogin: r.accountLogin,
+            accountType: r.accountType,
+            installedAt: r.installedAt,
+            suspended: r.suspendedAt !== null,
+        }));
+        const text = out.length === 0
+            ? 'No GitHub App installations registered.'
+            : out.map((r) => `- ${r.accountLogin} (${r.accountType}) - installed ${r.installedAt}${r.suspended ? ' - SUSPENDED' : ''}`).join('\n');
+        return {
+            content: [{ type: 'text', text }],
+            structuredContent: { installations: out },
+        };
+    };
+}

package/dist/tools/list-projects.js

@@ -0,0 +1,72 @@
+/**
+ * ORB-244 Phase A reference tool - `orboto_list_projects`.
+ *
+ * Maps to `GET /projects` in the orboto API, which already filters by
+ * the caller's visibility via the PBAC cascade. The MCP server is a
+ * transport adapter - it doesn't re-implement the ACL.
+ *
+ * Rest of the read-tool suite follows the same shape (see
+ * ticket ORB-244 Phase B). Keeping this first tool narrow on
+ * purpose - it's the one we wire + verify end-to-end before
+ * scaling out.
+ */
+import { z } from 'zod';
+export const listProjectsToolConfig = {
+    title: 'List projects',
+    description: 'Return projects the authenticated user can see (key, name, status). Useful first step of a workflow. '
+        + 'If you are after one project, pass `query` to filter by key/name instead of pulling the whole list - '
+        + 'and note you can usually use a project key directly with other tools without listing at all. '
+        + 'When the result says it is partial, refine with `query` rather than re-calling.',
+    // ORB-1109 - query + limit so a small-context agent (self-hosted /
+    // local 32k models over MCP) can narrow instead of ingesting every
+    // project.
+    inputSchema: z.object({
+        query: z.string().optional().describe('Substring matched against key or name.'),
+        limit: z.number().int().min(1).max(200).optional().describe('Max projects. Default 50.'),
+    }).shape,
+    // Well-formed output schema so MCP clients that honour it can
+    // surface structured data. Adding fields is safe; removing them is a
+    // breaking change for pinned client configs.
+    outputSchema: z.object({
+        projects: z.array(z.object({
+            // ORB-1179 - uuid alongside the key for downstream write tools.
+            id: z.string(),
+            key: z.string(),
+            name: z.string(),
+            status: z.string(),
+            description: z.string().nullable(),
+        })),
+        total: z.number(),
+        totalProjects: z.number(),
+        query: z.string().nullable(),
+    }).shape,
+    annotations: { readOnlyHint: true, idempotentHint: true },
+};
+export function makeListProjectsHandler(client) {
+    return async ({ query, limit } = {}) => {
+        const projects = await client.get('/projects');
+        const q = (query ?? '').trim().toLowerCase();
+        const matched = q
+            ? projects.filter((p) => `${p.key} ${p.name}`.toLowerCase().includes(q))
+            : projects;
+        const cap = Math.min(limit ?? 50, 200);
+        const shown = matched.slice(0, cap);
+        const rows = shown.map((p) => ({ id: p.id, key: p.key, name: p.name, status: p.status, description: p.description }));
+        // Text content is what the model reads; structured content is what
+        // the client UI renders. The text stays description-free (compact)
+        // and ends with a count line so a small model knows whether it has
+        // the whole set.
+        const lines = rows.map((r) => `- ${r.key} - ${r.name} (${r.status})`);
+        const partial = shown.length < matched.length;
+        const footer = matched.length === 0
+            ? (q ? `No projects match "${q}".` : 'No projects visible to this user.')
+            : partial
+                ? `\nShowing first ${shown.length} of ${matched.length} match(es) (of ${projects.length} total) - pass a narrower query to filter.`
+                : `\n(${matched.length} project(s)${q ? ` matching "${q}"` : ''}, complete.)`;
+        const text = matched.length === 0 ? footer : lines.join('\n') + footer;
+        return {
+            content: [{ type: 'text', text }],
+            structuredContent: { projects: rows, total: matched.length, totalProjects: projects.length, query: q || null },
+        };
+    };
+}

package/dist/tools/list-projects.test.js

@@ -0,0 +1,67 @@
+/**
+ * ORB-244 Phase A - reference test for `orboto_list_projects` tool
+ * mapping. Confirms that the tool handler:
+ *   - calls `GET /projects`
+ *   - produces both a text block (for the model) and structured content
+ *   - trims the REST response to the tool-schema shape
+ *
+ * Each future read-tool (Phase B) should follow this test shape.
+ */
+import { describe, expect, it, vi, beforeEach, afterEach } from 'vitest';
+import { OrbotoClient } from '../orboto-client.js';
+import { makeListProjectsHandler } from './list-projects.js';
+beforeEach(() => { vi.restoreAllMocks(); });
+afterEach(() => { vi.restoreAllMocks(); });
+function mockFetch(json) {
+    return vi.spyOn(globalThis, 'fetch').mockResolvedValue({
+        ok: true, status: 200, statusText: 'OK',
+        json: async () => json,
+    });
+}
+describe('tools/list-projects', () => {
+    const client = new OrbotoClient({ baseUrl: 'https://orboto.example.com', apiKey: 'orb_test' });
+    it('emits a human-readable text block + structured content', async () => {
+        mockFetch([
+            { id: 'p1', key: 'ACME', name: 'Acme', description: 'Customer portal', status: 'active' },
+            { id: 'p2', key: 'TOOL', name: 'Internal Tools', description: null, status: 'draft' },
+        ]);
+        const result = await makeListProjectsHandler(client)();
+        expect(result.content[0]).toEqual({
+            type: 'text',
+            text: '- ACME - Acme (active)\n- TOOL - Internal Tools (draft)\n(2 project(s), complete.)',
+        });
+        expect(result.structuredContent).toEqual({
+            projects: [
+                // ORB-1179 - uuid surfaced alongside the key
+                { id: 'p1', key: 'ACME', name: 'Acme', status: 'active', description: 'Customer portal' },
+                { id: 'p2', key: 'TOOL', name: 'Internal Tools', status: 'draft', description: null },
+            ],
+            total: 2,
+            totalProjects: 2,
+            query: null,
+        });
+    });
+    it('ORB-1109: filters by query and reports match count vs total', async () => {
+        mockFetch([
+            { id: 'p1', key: 'ACME', name: 'Acme', description: null, status: 'active' },
+            { id: 'p2', key: '10M', name: 'Math World', description: null, status: 'active' },
+            { id: 'p3', key: 'TOOL', name: 'Internal Tools', description: null, status: 'draft' },
+        ]);
+        const result = await makeListProjectsHandler(client)({ query: '10m' });
+        expect(result.content[0]).toEqual({ type: 'text', text: '- 10M - Math World (active)\n(1 project(s) matching "10m", complete.)' });
+        expect(result.structuredContent).toMatchObject({ total: 1, totalProjects: 3, query: '10m' });
+    });
+    it('ORB-1109: caps with limit and signals the list is partial', async () => {
+        mockFetch(Array.from({ length: 5 }, (_, i) => ({ id: `p${i}`, key: `P${i}`, name: `Proj ${i}`, description: null, status: 'active' })));
+        const result = await makeListProjectsHandler(client)({ limit: 2 });
+        const text = result.content[0].text;
+        expect(text).toContain('Showing first 2 of 5 match(es)');
+        expect(result.structuredContent).toMatchObject({ total: 5, totalProjects: 5 });
+    });
+    it('renders an empty-state text block when the API returns no rows', async () => {
+        mockFetch([]);
+        const result = await makeListProjectsHandler(client)();
+        expect(result.content[0]).toEqual({ type: 'text', text: 'No projects visible to this user.' });
+        expect(result.structuredContent).toMatchObject({ projects: [], total: 0, totalProjects: 0 });
+    });
+});

package/dist/tools/list-tickets.js

@@ -0,0 +1,86 @@
+/**
+ * ORB-244 Phase B - `orboto_list_tickets`.
+ *
+ * Lists tickets in a project with optional filters. The API endpoint
+ * (`GET /projects/:id/tickets`) supports cursor pagination; this
+ * tool returns the first page (50 by default) because an MCP tool
+ * call wants to fit inside a single model response - a power user
+ * who wants more paginates via more-specific filters instead.
+ */
+import { z } from 'zod';
+import { resolveProjectByKey, resolveTicketByKey, ticketLine, agentTicketListRow } from './shared.js';
+import { resolveMilestoneByNameOrId } from './milestones.js';
+export const listTicketsToolConfig = {
+    title: 'List tickets',
+    description: 'List tickets in a project, optionally filtered by status category, milestone name, or assignee email. Returns up to 50 tickets per call.',
+    inputSchema: z.object({
+        projectKey: z.string().min(1).describe('Project key (e.g. "ACME").'),
+        statusCategory: z
+            .enum(['todo', 'in_progress', 'in_review', 'done', 'wont_fix'])
+            .optional()
+            .describe('Filter to one workflow category. Omit for all.'),
+        milestone: z
+            .string()
+            .optional()
+            .describe('Key (ORB-M3), name, or UUID. Omit for all, backlog included.'),
+        assigneeEmail: z
+            .string()
+            .optional()
+            .describe('Project-member email. Omit for all, unassigned included.'),
+        parentTicketKey: z
+            .string()
+            .optional()
+            .describe('Only children of this ticket - walks an epic.'),
+        limit: z.number().int().min(1).max(50).default(25).describe('Max rows to return.'),
+        verbose: z.boolean().default(false).describe('true = full rows; default is the decision fields only.'),
+    }).shape,
+    annotations: { readOnlyHint: true, idempotentHint: true },
+};
+export function makeListTicketsHandler(client) {
+    return async (input) => {
+        const project = await resolveProjectByKey(client, input.projectKey);
+        const qs = new URLSearchParams();
+        qs.set('limit', String(input.limit ?? 25));
+        if (input.statusCategory)
+            qs.set('statusCategory', input.statusCategory);
+        // Milestone + assignee need a UUID on the API; resolve them here
+        // from the project payload instead of forcing the caller to paste
+        // a UUID.
+        if (input.milestone) {
+            // ORB-1696 - shared resolver: key (ORB-M3), name or UUID, ambiguous
+            // name -> explicit error. Matches create_ticket/set_milestone/OQL.
+            const m = await resolveMilestoneByNameOrId(client, project.id, input.milestone);
+            qs.set('milestoneId', m.id);
+        }
+        if (input.assigneeEmail) {
+            // Members endpoint returns `{userId, user: {email, ...}, role: {...}}`;
+            // we need to peek inside `user` to match by email.
+            const members = await client.get(`/projects/${project.id}/members`);
+            const member = members.find((x) => x.user.email.toLowerCase() === input.assigneeEmail.toLowerCase());
+            if (!member)
+                throw new Error(`No project member with email "${input.assigneeEmail}".`);
+            qs.set('assigneeId', member.userId);
+        }
+        if (input.parentTicketKey) {
+            const parent = await resolveTicketByKey(client, input.parentTicketKey);
+            qs.set('parentTicketId', parent.id);
+        }
+        const page = await client.get(`/projects/${project.id}/tickets?${qs}`);
+        const text = page.items.length === 0
+            ? `No tickets in project ${project.key} matching the filters.`
+            : page.items.map((t) => `- ${ticketLine(t)}`).join('\n');
+        const moreHint = page.nextCursor
+            ? `\n\n(${page.items.length} shown; more exist - narrow the filters to see them.)`
+            : '';
+        return {
+            content: [{ type: 'text', text: text + moreHint }],
+            structuredContent: {
+                project: { key: project.key },
+                count: page.items.length,
+                hasMore: !!page.nextCursor,
+                // ORB-1699 - shared lean row; verbose restores uuid/labels/minutes.
+                tickets: page.items.map((t) => agentTicketListRow(t, input.verbose ?? false)),
+            },
+        };
+    };
+}

package/dist/tools/milestones-crud.test.js

@@ -0,0 +1,154 @@
+/**
+ * ORB-799 - milestone CRUD additions to `milestones.ts`.
+ *
+ * `list_milestones` + `get_milestone` already have coverage in
+ * `phase-b-tools.test.ts`. This file covers the new write surface:
+ * create, close (incl. archive), update.
+ */
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
+import { OrbotoApiError, OrbotoClient } from '../orboto-client.js';
+import { makeCreateMilestoneHandler, makeCloseMilestoneHandler, makeUpdateMilestoneHandler, } from './milestones.js';
+beforeEach(() => { vi.restoreAllMocks(); });
+afterEach(() => { vi.restoreAllMocks(); });
+function stub(responses) {
+    const calls = [];
+    vi.spyOn(globalThis, 'fetch').mockImplementation(async (url, init) => {
+        calls.push({
+            url: url.toString(),
+            method: init?.method ?? 'GET',
+            body: init?.body ? JSON.parse(init.body) : undefined,
+        });
+        const r = responses.shift();
+        if (!r)
+            throw new Error(`unexpected extra fetch`);
+        return {
+            ok: r.ok ?? true,
+            status: r.status ?? 200,
+            statusText: 'OK',
+            json: async () => ('json' in r ? r.json : {}),
+            text: async () => '',
+        };
+    });
+    return calls;
+}
+const client = new OrbotoClient({ baseUrl: 'https://orboto.example.com', apiKey: 'orb_x' });
+const PROJ = { id: 'p1', key: 'ACME', name: 'Acme', description: null, status: 'active' };
+const MILESTONE = {
+    id: 'm1', projectId: 'p1', name: 'v1.0', status: 'active',
+    startDate: null, endDate: null, isPrivate: false,
+};
+describe('orboto_create_milestone', () => {
+    it('POSTs name only (dates omitted) when no dates supplied (ORB-1825)', async () => {
+        const calls = stub([
+            { json: PROJ },
+            { json: { ...MILESTONE, name: 'v2.0' } },
+        ]);
+        const res = await makeCreateMilestoneHandler(client)({
+            projectKey: 'ACME', name: 'v2.0',
+        });
+        // ORB-1825 - startDate/endDate are nullable().optional() on the API's
+        // create body now; an absent key means the same thing as null, so the
+        // tool no longer forces `?? null` and the wire body simply omits them.
+        expect(calls[1]).toMatchObject({
+            method: 'POST',
+            url: 'https://orboto.example.com/projects/p1/milestones',
+            body: { name: 'v2.0', isPrivate: false },
+        });
+        expect(calls[1].body).not.toHaveProperty('startDate');
+        expect(calls[1].body).not.toHaveProperty('endDate');
+        expect(res.structuredContent).toMatchObject({ name: 'v2.0', projectKey: 'ACME' });
+    });
+    it('passes dates + isPrivate through verbatim', async () => {
+        const calls = stub([
+            { json: PROJ },
+            { json: { ...MILESTONE, name: 'Q3', startDate: '2026-07-01', endDate: '2026-09-30', isPrivate: true } },
+        ]);
+        await makeCreateMilestoneHandler(client)({
+            projectKey: 'ACME', name: 'Q3', startDate: '2026-07-01', endDate: '2026-09-30', isPrivate: true,
+        });
+        expect(calls[1].body).toEqual({
+            name: 'Q3',
+            startDate: '2026-07-01',
+            endDate: '2026-09-30',
+            isPrivate: true,
+        });
+    });
+    it('surfaces a 403 on POST as OrbotoApiError', async () => {
+        stub([
+            { json: PROJ },
+            { ok: false, status: 403, json: { error: 'forbidden' } },
+        ]);
+        await expect(makeCreateMilestoneHandler(client)({ projectKey: 'ACME', name: 'v1' })).rejects.toBeInstanceOf(OrbotoApiError);
+    });
+});
+describe('orboto_close_milestone', () => {
+    it('looks up by name including closed milestones, then PATCHes status=completed', async () => {
+        const calls = stub([
+            { json: PROJ },
+            { json: [MILESTONE] }, // includeClosed=true lookup
+            { json: { ...MILESTONE, status: 'completed' } },
+        ]);
+        const res = await makeCloseMilestoneHandler(client)({
+            projectKey: 'ACME', milestone: 'v1.0',
+        });
+        expect(calls[1].url).toContain('includeClosed=true');
+        expect(calls[2]).toMatchObject({
+            method: 'PATCH',
+            body: { status: 'completed' },
+        });
+        expect(res.structuredContent).toMatchObject({ status: 'completed' });
+    });
+    it('archive=true PATCHes status=archived', async () => {
+        const calls = stub([
+            { json: PROJ },
+            { json: [MILESTONE] },
+            { json: { ...MILESTONE, status: 'archived' } },
+        ]);
+        await makeCloseMilestoneHandler(client)({
+            projectKey: 'ACME', milestone: 'v1.0', archive: true,
+        });
+        expect(calls[2].body).toEqual({ status: 'archived' });
+    });
+    it('looks up by UUID when the input matches the UUID regex', async () => {
+        const calls = stub([
+            { json: PROJ },
+            { json: [MILESTONE, { ...MILESTONE, id: '11111111-2222-3333-4444-555555555555', name: 'other' }] },
+            { json: { ...MILESTONE, status: 'completed' } },
+        ]);
+        await makeCloseMilestoneHandler(client)({
+            projectKey: 'ACME', milestone: '11111111-2222-3333-4444-555555555555',
+        });
+        // PATCH URL should hit the UUID, not the first row.
+        expect(calls[2].url).toContain('/milestones/11111111-2222-3333-4444-555555555555');
+    });
+    it('throws a clear error when milestone is not found', async () => {
+        stub([
+            { json: PROJ },
+            { json: [] },
+        ]);
+        await expect(makeCloseMilestoneHandler(client)({ projectKey: 'ACME', milestone: 'ghost' })).rejects.toThrow(/Milestone "ghost" not found/);
+    });
+});
+describe('orboto_update_milestone', () => {
+    it('PATCHes only the supplied fields', async () => {
+        const calls = stub([
+            { json: PROJ },
+            { json: [MILESTONE] },
+            { json: { ...MILESTONE, name: 'v1.0.1' } },
+        ]);
+        await makeUpdateMilestoneHandler(client)({
+            projectKey: 'ACME', milestone: 'v1.0', patch: { name: 'v1.0.1' },
+        });
+        expect(calls[2].body).toEqual({ name: 'v1.0.1' });
+    });
+    it('surfaces a 403 on PATCH', async () => {
+        stub([
+            { json: PROJ },
+            { json: [MILESTONE] },
+            { ok: false, status: 403, json: { error: 'forbidden' } },
+        ]);
+        await expect(makeUpdateMilestoneHandler(client)({
+            projectKey: 'ACME', milestone: 'v1.0', patch: { isPrivate: true },
+        })).rejects.toBeInstanceOf(OrbotoApiError);
+    });
+});